notify

Overview ¶

Package notify folds the Hanzo Notify SEND surface into the unified cloud binary (HIP-0106), mounting /v1/notify/* natively in-process — the native replacement for the standalone notifyd (github.com/hanzoai/notify) Deployment.

SCOPE — the one live contract. notifyd's ONLY production consumer is Hanzo IAM, which POSTs OTP sends to POST /v1/notify/send?sync=true with the wire body

{"to":["…"],"channel":"sms|email","event":"iam.otp_sent",
 "template_vars":{"otp":"…","recipient":"…","app":"…"}}

and treats a response status of "sent"/"delivered" as success (see hanzoai/iam object/notify_delivery_http.go). This subsystem serves that exact contract natively. Everything else notifyd carries — the tenants/templates/ providers/preferences/unsubscribe/metering/events/messages collections and the hanzoai/tasks (Temporal) async worker — has NO live consumer (the live tenant's template/provider/event tables are empty and only IAM calls /send), so it is deliberately NOT folded. The Temporal notify-send queue plane is owned elsewhere and is not touched here; async sends (no ?sync=true) return 503, exactly as notifyd does when it runs without a connected worker.

DRY — no reimplementation of provider plumbing. The actual provider implementations and the wire structs are notifyd's OWN public packages, imported directly: github.com/hanzoai/notify/service/{twilio,twilioemail,plivo,mail} and github.com/hanzoai/notify/pkg/types. Only the thin credential→constructor glue (constructProvider) — which lives in notifyd's internal/ and is therefore not importable across the module boundary — is mirrored here, matching internal/tenant/tenant.go verbatim.

SECURITY — the trust boundary moves with the code. notifyd was ClusterIP-internal and trusted a raw X-Org-Id header. Mounted here, /v1/notify/send is reachable via the public gateway (api.hanzo.ai forwards every path to cloud), so — like clients/auto did when it folded the auto engine — this gates on a VALIDATED principal and derives the org from principal.Tenant (the identity middleware's trusted, gateway-minted X-Org-Id), never from a client-supplied header. An unauthenticated caller gets 401; a signed-in caller can only send scoped to their OWN org.

CREDENTIALS — never plaintext. Provider credentials are read from env (the KMS-synced notify-twilio Secret the operator injects, exactly as notifyd reads them) and, for keys absent from env, from KMS via cloud.Deps.KMS under the documented shared/<service>/<key> and tenants/<org>/<service>/<key> paths. No secret is ever hard-coded or logged.